🔍 Read the full analysis: What To Know About AI And Supermarket Refrigeration Attacks on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A reported overnight cyberattack on Nov. 1–2 disrupted supermarket refrigeration systems in at least six European countries, with reports also describing problems at a few Finnish stores. Retailers reported spoiled food and affected stores often used equipment outside central network safeguards; who was responsible and whether AI played any role remain unknown.
Supermarket refrigeration systems in at least six European countries were reportedly disrupted overnight on Nov. 1–2 after attackers accessed internet-reachable controllers and switched some equipment into defrost or heating modes. Retailers and media reports describe food losses and affected stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, with Finnish authorities and retailer Kesko also reporting problems at a few stores; no evidence cited so far establishes that AI was used.
Belgian installer Sabcobel said evaporators at affected sites had been switched remotely into defrost mode, using a mechanism it described as the same as in a wave of French incidents on Oct. 11–12. Sabcobel chief executive Stephan Moelans told Belgian outlets that technicians began disconnecting installations at about 1 a.m. and that the company itself had not been hacked: the affected controllers were accessible over the internet. He said about 20 of several hundred installations managed by Sabcobel in Belgium were affected.
Retailer reports vary by company and location. Ahold Delhaize said it had identified an IT incident affecting refrigeration systems in several dozen stores; BleepingComputer put the figure at about 40 stores in Belgium and Luxembourg. Carrefour Belgium said 15 of its 700 stores were affected, while Colruyt said the problem involved about five independently operated Spar stores using their own refrigeration systems. In Sweden, ICA reported at least four affected stores outside its central network, and Coop reported seven of more than 800 stores affected. Reports also name about 15 Intermarché outlets in Belgium, one IKEA store in Mons, 13 SuperValu stores in Ireland and one Selver store in Estonia. Dutch broadcaster NOS reported that at least 17 businesses in the Netherlands were affected, mostly butchers and neighbourhood shops.
Some operators reported food losses, but the scale is not settled. A Proxy Delhaize shop in Hoepertingen estimated that it had to discard at least €60,000 of food after freezers reached 15 °C, according to local reporting cited by VRT NWS. A butcher in Hove reportedly discarded hundreds of kilos. In other cases, staff noticed the problem and stopped equipment before reported losses. Finnish authorities and Kesko described temperature anomalies at a few smaller stores, but the available reports do not provide a complete, independently verified count across all countries.
Cybersecurity · Retail infrastructure · Europe
What to Know About AI and Supermarket Refrigeration Attacks
Reports describe an overnight disruption to refrigeration controls across Europe. Food losses were reported, but the responsible party and any role for AI remain unknown.
01 / What happened
Connected controls, real-world consequences
Reports say attackers accessed refrigeration controllers reachable over the internet and remotely changed equipment settings. Some units entered defrost or heating modes, disrupting cooling.
Controller exposed
Remote management interfaces were reportedly reachable online.
Settings changed
Some refrigeration units were switched into defrost or heating modes.
Cooling disrupted
Freezers warmed; staff at some stores stopped equipment or isolated systems.
Losses reported
Retailers described spoiled stock, interrupted trading, and repair work.
02 / Reported footprint
Store counts vary by source
Retailer statements and media accounts describe affected sites in several countries. These figures have not been reconciled into one independently verified total.
03 / Why it matters
Local equipment can create a security gap
The incident highlights how building systems can affect daily operations, even when office networks and customer data are not the reported target.
Cooling is essential infrastructure
Disrupted refrigeration can mean spoiled stock, interrupted trading, and repair costs. Smaller operators may have fewer backup systems and technical resources.
Store-managed systems can be harder to oversee
Some affected stores reportedly used equipment outside central corporate networks or managed it independently. That does not prove this caused the attacks.
Cyber incident does not establish AI use
The reports describe changes to refrigeration controllers. They do not show that an AI system found the devices, chose targets, or altered settings.
04 / Earlier incident
A similar French wave was reported in October
French authorities had warned that exposed remote-management interfaces were a risk. Similarity may suggest a technical link, but it does not identify the actor or prove every disruption had the same cause.
What reports connect
The French incidents occurred overnight on Oct. 11–12. The Paris prosecutor’s office counted about 700 affected sites, according to the supplied reporting.
CERT-FR warned on Oct. 12 that refrigeration controller interfaces were exposed online contrary to good practice, and that campaigns might still be ongoing. Sabcobel said the November mechanism matched the French wave.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
— Ahold Delhaize“Currently 15 of our 700 stores are affected, both in Flanders and Wallonia.”
— Carrefour Belgium05 / Attribution and AI
Key facts remain unresolved
Investigations are continuing. No group has claimed responsibility, and the cited reports do not establish that AI played a part in the campaign.
No public attribution
Belgium’s federal prosecutor has opened a criminal investigation. The cyber centre has cautioned that the attacker may never be identified.
Counts are provisional
One report counted more than 115 stores in six countries. Other accounts differ, and additional Finnish reports add a few stores.
Unconfirmed, with no cited proof
Broader warnings about AI-enabled attacks do not establish AI use in this incident. Officials and affected companies cited have not said AI was used.
06 / Questions to watch
What remains to be established
Authorities and companies are assessing affected systems and losses. The available reports do not yet answer several practical questions.
How many sites were affected?
Reported totals differ across companies, authorities, and media. No final, independently verified count is available.
How much food was lost?
Some operators reported discarded stock, including one Belgian shop’s estimate of at least €60,000. Overall losses are unsettled.
Are exposed controllers secured?
Reports do not fully describe whether vulnerable interfaces were disconnected or protected, or whether access controls and updates were applied.
Who was responsible, and was AI involved?
Both remain unknown. No public claim of responsibility or evidence of AI use has been cited in the available reporting.
Risks From Exposed Store Equipment
The incident shows how internet-connected building systems can affect ordinary business operations, not just office computers or customer data. When refrigeration controls are disrupted, stores can face spoiled stock, interrupted trading and repair costs. The reported food losses illustrate a direct consequence for retailers, while failures at small shops may carry a greater burden when operators have fewer replacement systems or technical resources.
Several affected retailers said the stores were outside their central networks or used equipment they managed independently. That does not prove that being outside a corporate network caused the attacks, but it points to a practical security challenge: equipment owned or managed locally can be harder for a chain to monitor and protect consistently. The reports also make clear that the intrusion method described is a cybersecurity issue involving refrigeration controllers, rather than evidence that an AI system autonomously attacked stores.
Products Worth Considering
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
Samsung 27-Inch Odyssey OLED G5 QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar French Incident in October
The reported incidents follow a refrigeration-control attack in France during the night of Oct. 11–12. The Paris prosecutor’s office counted about 700 affected sites, according to the source material. France’s national cybersecurity agency, CERT-FR, warned on Oct. 12 that remote management interfaces for refrigeration controllers were exposed online contrary to good practice and said attack campaigns were probably still ongoing.
For the Nov. 1–2 incidents, Sabcobel said the mechanism matched the French wave. Finland’s National Cyber Security Centre said attacks there and elsewhere targeted specific Danfoss models, according to Finnish news agency STT. These accounts provide a possible technical link between incidents, but they do not identify who carried them out or establish that every reported outage had the same cause.
Reported totals differ. BleepingComputer counted more than 115 stores in six countries, while other accounts give different country or retailer totals, and Finnish reports add a small number of stores outside that six-country count. Temperature reports also vary by site, from 15 °C in one Belgian shop to much higher readings elsewhere. The figures should be treated as provisional rather than as a single verified tally.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
— Ahold Delhaize
Attribution, AI and Final Counts
No group has claimed responsibility, and the source reports no public attribution by investigators. Belgium’s federal prosecutor has opened a criminal investigation. Belgium’s cyber centre has cautioned that the attacker may never be identified. It is also unclear whether all reported disruptions were carried out by the same person or group, despite the reported similarity to the French incidents.
AI’s role is unconfirmed. Belgium’s cyber centre has warned more broadly about attacks that may involve AI, but officials and affected companies cited in the reports have not said AI was used in this campaign. There is no reported evidence that an AI system discovered the controllers, selected targets or changed their settings.
The final number of affected sites, the total value of food lost, the precise entry route for each controller and whether all vulnerable systems have been secured remain unknown. Reported store counts come from different companies, media outlets and authorities and do not yet form one reconciled total.
Investigations and Controller Security
Belgium’s criminal investigation is continuing, while retailers and technical providers are assessing affected systems and losses. The reports do not give a timetable for a final count or for findings on who was responsible. Authorities and companies may provide further details as those inquiries progress.
France’s CERT-FR had already warned that exposed remote-management interfaces were a risk and that campaigns might be ongoing. The immediate security questions are whether affected controllers have been disconnected or protected, whether software updates and access controls have been applied, and whether similar equipment remains reachable online. Those measures and their results have not been fully described in the available reports.
Key Questions
What happened to the supermarkets?
Reports say attackers remotely changed settings on refrigeration controllers at stores across Europe, causing some units to defrost, heat or stop cooling. The reported incidents occurred overnight on Nov. 1–2, 2026.
How many stores were affected?
BleepingComputer reported more than 115 stores across six countries, while separate reporting describes problems at a few Finnish stores as well. Counts differ between sources and have not been reconciled into a final verified total.
Was AI used in the attacks?
That has not been established. Officials have discussed AI in the broader threat environment, but the reports do not provide evidence that AI was involved in these particular incidents.
Who carried out the attacks?
No perpetrator has been identified publicly, and no one has claimed responsibility in the cited reports. Belgium’s federal prosecutor has opened an investigation.
Why were smaller or independently run stores affected?
Some affected retailers said those stores operated outside central networks or used their own refrigeration equipment. That may help explain differences in oversight, but the available information does not establish it as the cause of the incidents.
Source: ThorstenMeyerAI.com
